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TESTING FROM HIGH POWERS OVER FINITE 

FIELDS 
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NITIN SAXENA, AND IGOR E. SHPARLINSKI 


Abstract. We consider the problem of recovering (that is, inter¬ 
polating) and identity testing of a “hidden” monic polynomial /, 
given an oracle access to f(x) e for x £ F q (extension fields ac¬ 
cess is not permitted). The naive interpolation algorithm needs 
O(edegf) queries and thus requires edeg / < q. We design al¬ 
gorithms that are asymptotically better in certain cases; requiring 
only e°V queries to the oracle. In the randomized (and quantum) 
setting, we give a substantially better interpolation algorithm, that 
requires only 0(deg / log g) queries. Such results have been known 
before only for the special case of a linear /, called the hidden 
shifted power problem. 

We use techniques from algebra, such as effective versions of 
Hilbert’s Nullstellensatz, and analytic number theory, such as re¬ 
sults on the distribution of rational functions in subgroups and 
character sum estimates. 


1. Introduction 

Let ¥ q be a finite field of q elements. Here we consider several prob¬ 
lems of recovering and identity testing of a “hidden” monic polynomial 
/ G F g [X], given O e j an oracle that on every input x G ¥ q outputs 
O e j(x) = f(x) e for some large positive integer e | q — 1. 

More precisely, we consider the following problem Interpolation from 
Powers: 

given an oracle D e j for some unknown monic polyno¬ 
mial / G F f/ [X], recover /. 

We also consider the following two versions of the Identity Testing 
from Powers: 
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given an oracle O e j for some unknown monic polyno¬ 
mial / G F (/ [X] and another known polynomial g G 
F 9 [X], decide whether f = g, 

and 

given two oracles O e j and D e)ff for some unknown monic 
polynomials /, g G FjX], decide whether f — g. 

In particular, for a linear polynomial f(X) = X + s, with a ‘hidden’ 
a G Fg, we denote O e j = O ejS . We remark that in this case there are 
two naive algorithms that work for linear polynomials: 

• One can query O eiS at e + 1 arbitrary points and then using 
a fast interpolation algorithm, see [ vzGG13j . get a determin¬ 
istic algorithm of complexity e(logg) 0 W (as in |vzGG13| . we 
measure the complexity of an algorithm by the number of bit 
operations in the standard RAM model). 

• For probablistic testing one can query O etS (and O e j) at ran¬ 
domly chosen elements x G F q until the desired level of confi¬ 
dence is achieved (note that the equation (x + s) e = (x + t) e 
has at most e solutions x G F f/ ). 

These naive algorithms have been improved by Bourgain, Garaev, 
Konyagin and Shparlinski |BGKS12j in several cases (with respect to 
both the time complexity and the number of queries). 

Furthermore, in the case when a quantum version of the oracle O etS 
is given, van Darn, Hallgren and Ip [ vDHI06] have given a polynomial 
time quantum algorithm which recovers s, see also [ vD02 ]. 

For non-linear polynomials / G F q [X ] some classical and quantum 
algorithms are given by Russell and Shparlinski [ RS04 ]. However they 
do not reach the level of those of |BGKS12l lvD021 IvDHIOhj due to sev¬ 
eral additional obstacles which arise for non-linear polynomials. For 
example, we note that both the interpolation and random sampling 
algorithms fail if edeg / > q. Indeed, note that queries from the ex¬ 
tension held are not permitted, and F q may not have enough elements 
to make these algorithms correct. 

Here we consider both classical and quantum algorithms. In par¬ 
ticular, we extend the results of [ BGKS12 , Section 3.3] to arbitrary 
monic polynomials / G F p [A] for a prime p. These results are based on 
some bounds of character sums and also new results about the order 
of multiplicative group generated by the values of a rational function 
on several consecutive integers. 

Further, we also consider quantum algorithms. However, our setting 
is quite different from those of [ vD02l lvDHI06j as we do not assume 
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that the values of / are given by a quantum oracle, rather the algorithm 
works with the classical oracle O e j. 

The above questions appear naturally in understanding the pseudo- 
randomness of the Legendre symbol (^~^j • In particular, this has ap¬ 
plications in the cryptanalysis of certain homomorphic cryptosystems. 
See |BM84l IBL961 IDam901 IMvOVIO] for further details. 

Note that the above questions are closely related to the general prob¬ 
lem of oracle (also sometimes called “black-box”) polynomial interpola¬ 
tion and identity testing for arbitrary polynomials (though forbidding 
the use of held extensions makes the problems harder), see [ Sax091. 
ISaxl41 ISYlOj and the references therein. 

Throughout the paper, any implied constants in the symbols O, <C 
and may occasionally, where obvious, depend on the degree d of the 
polynomial / (& an integer parameter u), and are absolute otherwise. 
We recall that the notations U = 0(V), U <C V and V U are all 
equivalent to the statement that the inequality \U\ < cV holds with 
some constant c > 0 . 

2. Identity Testing on Classical Computers 

2.1. Main results. Here we consider the identity testing case of two 
unknown monic polynomials /, g £ F 9 [X] of degree d given the oracles 
O e j and £> e)S . We remark that if f/g is an (q — l)/e-th power of a non¬ 
constant rational function over F q then it is impossible to distinguish 
between / and g from the oracles O e j and £) e , s . We write / ~ e 9 hr 
this case, and / 7 C g otherwise. 

We note that it is shown in the proof of |RS04 . Theorem 6 ] that 
the Weil bound of multiplicative character sums (see [ IK04., Theo¬ 
rem 11.23]) implies that given two oracles D e j and D ej9 for some 
unknown monic polynomials /, g £ F ? [X] with / g one can de¬ 
cide whether f = g in time qlY+'C) _ Note that the result of |RS04j 
is stated only for prime fields F p but it can be extended to arbitrary 
fields at the cost of only typographical changes. The same holds for 
here the results of Section [3] but the results of Section [2] hold only for 
prime fields. 

For “small” values of e, over prime fields F p , we have a stronger 
result. 

Theorem 1 (Small e). For a prime p and a positive integer e \ p — 1, 
with e < p 5 for some fixed 5 > 0, given two oracles D e j and D Stg 
for some unknown monic polynomials /, g (E F P [X] of degree d with 
f 7 ^ e g, there is a deterministic algorithm to decide whether f = g in 
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e c°(d)5 1/ < 2d 11 q Uer i es t 0 the oracles D e j and D e , g , where co(d) depends 
only on d. 

In particular, we see from (the proof of) Theorem [l] that if e = p °^ 
and e —>■ oo then we can test whether f = g in time e 0 ^^(logp)°d) in 
e°^ oracle calls. 

For intermediate values of e, the following result complements both 
Theorem [I] and the result of [R.S04] . We, however, have to assume that 
the polynomials / and g are irreducible. 


Theorem 2 (Medium e). For a prime p and a positive integer e \ p— 1, 
with e < p v ~ 5 for some fixed S > 0, given two oracles O e j and D e . g for 
some unknown monic polynomials /, g G F P [X] of degree d > 1 with 
f r f j e g, there is a deterministic algorithm to decide whether f = g in 
e K+s queries to the oracles O e j and O et9 , where 


Ad-l 


V = 


and 


2d 


K = 


Ad 2 (d + l) 2 ” Ad — 1 

The proofs of Theorems [l] and [2] are given below in Sections 2.5 
and [2 TeJ respectively. 


2.2. Background from arithmetic algebraic geometry. Our ar¬ 
gument makes use of a slight modification of [ BUKH121, Lemma 23], 
which is based on a quantitative version of effective Hilbert’s Null- 
stellensatz given by D’ Andrea, Krick and Sombra [DKS13] . which im¬ 
proved the previous estimates due to Krick, Pardo and Sombra |KPS01] . 

As usual, we define the logarithmic height of a nonzero polynomial 
P G Z[Zi,..., Z n ] as the maximum logarithm of the largest (by abso¬ 
lute value) coefficient of P. 

The next statement is essentially |BGKS12l Lemma 23], however we 
now use |DKS131 Theorem 2] instead of |KPS011 Theorem 1], 

Lemma 3. Let Pi, ..., Pn G Z[Zi, ..., Z n ] be N > 2 polynomials in n 
variables of degree at most D > 3 and of logarithmic height at most FI 
and let R G Z \Z \,..., Z n ] be a polynomial in n variables of degree at 
most d > 3 and of logarithmic height at most h such that R vanishes 
on the variety 

Pi(Zi, • • •, Z n ) = ... = P N {Zi ,..., Z n ) = 0. 

There are polynomials Qi, ■ ■ ■ ,Qn G Z [Z\,..., Z n ] and positive integers 
A and r with 

log A < 2(n + l)dD n H+ 3D n+1 h + C(d,D,n,N), 

such that 

PiQi + • • • + P N Qn = AR r , 
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where C(d, D,n, N) depends only on d, D, n and N. 

We note that using Lem ma [3| in the argument of [BGKS12] allows 
to replace z/ -4 with z/ -3 in [BGKS121 Lemma 35]. In turn, this allows 
us to replace <5 4 / 3 with 5 1 / 2 in [ BGKS12 . Lemma 38 and Theorem 51]. 

We now define the logarithmic height of an algebraic number a / 0 
as the logarithmic height of its minimal polynomial. 

We need a slightly more general form of a result of Chang [ Cha03 ]. 
In fact, this is exactly the statement that is established in the proof 
of |Cha03l Lemma 2.14], see |Cha03l Equation (2.15)]. 

Lemma 4. Let Pi,..., Py, R E 7L[Z i,..., Z n ] be N +1 > 2 polynomials 
in n variables of degree at most D and of logarithmic height at most 
H > 1. If the zero-set 

Pi(Zi, • • •, Z n ) = ... = P N (Z U ..., Z n ) = 0 and R{Z \,..., Z n ) 0 

is not empty then it has a point (/3 1 ,, (3 n ) in an extension K of Q of 
degree [IK : Q] < CfD,n) such that its logarithmic height is at most 
C 2 (D,n, N)H, where C\(D,n) depends only on D, n and C 2 (D,n, N) 
depends only on D, n and N. 

2.3. Product sets in number fields. For a set A in an arbitrary 
semi-group, we use A^ to denote the u-fold product set, that is 

A^ u) = {ai... a u : cq,..., a u G A}. 

We recall the following result given in [BGKS121 Lemma 29], which 
in turn generalises [BKS08. Corollary 3]. 

Corollary 5. Let IK be a finite extension of Q of degree D — [IK : Q], 
Let C C IK be a finite set with elements of logarithmic height at most 
H > 2. Then we have 

#C<"> > exp f-c (D,v)-dLA (#C)", 

where c(D, u) depends only on D and u. 

2.4. Product sets of consecutive values of rational functions 
in prime fields. We now show that for a nontrivial rational function 
f/g E F p (W) and an integer h > 1, the set formed by h consecutive 
values of f/g cannot be all inside a small multiplicative subgroup Q C 
F*. For the linear fractional function (A" + s)/(A" + t ) this has been 
obtained in BG KS1 2. Lemma 35]. 

Lemma 6. Let v > 1 be a fixed integer. Assume that for some suffi¬ 
ciently large positive integer h and prime p we have 

h < pA d >~ 2 \ 
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where c(d ) depends only on d. For two distinct monic polynomials 
/, g £ F p of degrees d, we consider the set 


A 



1 < x < h \ C F 


— f — ^ P’ 


Then 


> exp (~c{d,v)—j ° g h h v , 

V V log log h) 

where c(d, u) depends only on v and d. 


Proof. We closely follow the proof of IBCKS12. Lemma 35]. Let 

d — 1 d— 1 

f(X) =X d + J2 Ti-k.x k and g{X) = X d + ^ b d - t X l . 

k =0 1=0 

The idea is to move from the finite held to a number held, where we 
are in a position to apply Corollary [5} 

We consider the collection V C Z[U, V], where 

U = (U 1 ,...,U d ) and V = 

of polynomials 

v / d— 1 \ / d— 1 

jv»(u, v) = n K+E h?+E 

t=i V k =o / V e=o 

-nfxf+Ew) 

i=i \ r=o / V fc=o 

where x = (aq,... ,x u ) and y = (r/i,... ,y u ) are integral vectors with 
entries in X := [1, h\ and such that 

P XiY (xi, ...,x d ,y 1 ,...,y d ) = 0 (mod p). 

Note that 

V V 

P x , y (ai, ■ ■ ■, a d , b d ) = JJ f(xi)g(yi ) - JJ f(yi)g(xi ) (mod p). 

2=1 2=1 

Clearly if P x>y is identical to zero then, by the uniqueness of poly¬ 
nomial factorisation in the ring F P [U, V], the components of y are 
permutations of those of x. So in this case we obviously obtain 

#A M > ^ {fff(T)Y » H\ 

Hence, we now assume that V contains non-zero polynomials. 

Clearly, every P 6 V is of degree at most 2 v and of logarithmic 
height O(logh). 
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We take a family Vo containing the largest possible number 

N < 0 + l) 2d -l 

of linearly independent polynomials Pi,, Pry E V , and consider the 
variety 

V: {(U,V)GC M : P 1 (U,V) = ...=P JV (U,V) = 0}. 

Clearly V 7 ^ 0 as it contains the diagonal U = V. 

We claim that V contains a point outside of the diagonal, that is, 
there is a point (/3, 7 ) with (3 ,7 E C d and (3 7 ^ 7 . 

Assume that V does not contain a point outside of the diagonal. 
Then for every k — 1,..., d, the polynomial 

Rk(Ui,...,U d ,V 1 ,...,V d ) = U k -V k 

vanishes on V. 

Then by Lemma[3]we see that there are polynomials Q k ,i, ■ ■ ■, Qk,N G 
Z[U, V] and positive integers A k and r k with 

( 1 ) log A k < c 0 d(2u) 2d log h 

for some absolute constant c 0 (provided that h is large enough) and 
such that 

(2) P\Qk,i + • • • + PnQ^n = A k (U k — V k ) rk . 

Since / 7 ^ g, there is k E {1,..., d} for which a k ^ b k (mod p). For 
this k we substitute 


(U, V) = (ai ,... ,a d ,bi,... ,b d ) 


in ([ 2 ]). Recalling the definition of the set V we now derive that p \ A k . 
Taking 


c(d) 


1 

cod2 d + 1 


in the condition of the lemma, we see from (|Tj) that this is impossible. 
Hence the set 


w = vn[u-v^o] 

is nonempty. Applying Lemma [3] we see that it has a point (/3, 7 ) with 
components of logarithmic height 0(logh ) in an extension K of Q of 
degree [K : Q] < A (d, v), where A (d, u) depends only on d and u. 
Consider the maps $ : X v —> ¥ p given by 


$ : 


x = 


(xi,.. • ,xu) ^ n 
3= 1 


f(*j) 

9(xj) 
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and T : T v —> IK given by 

'b : x = (a*, ■ ■ ■ , x v ) ^ 

7 i G'l ( x j) 

where 

d -1 d—1 

Fp{X) = X d + Y, Pd-kX k and G 7 (X) = X d + ^ ld _ e X l . 

k=0 £=0 

By construction of (/ 3,-y) we have that \h(x) = T(y) if $(x) = <f>(y). 
Hence 

#A (u) > ImT = #C (l/) , 
where ImT is the image set of the map T and 

F fi (x) 


C = 


G 7 (x) 


1 < x < h > Cl. 


□ 


Using Corollary [5j we derive the result. 

We also recall the following bound which is a special case of a more 
general result from [ GP£fl5l Theorem 7]. 

Lemma 7. If for two relatively prime monic polynomials f,gE F p of 
degree d > 1, a positive integer h and a multiplicative subgroup Q C F* 
we have 

f( x ) 


: 1 < x < h > C Q. 


Then 

where 


9(x) 


#G > min{/i 2 ( 1 - T)+o( 1 ) ,/r 2 ( 1 - p - T)+o( 1 V M }, 


■& = 


2d(d + 2)’ P 2(d + 2) ’ 
and the implied constant depends on d. 

Proof. By [GPS15L Theorem 7], applied with d = e (and thus with 
k = d(d + l) 2 , s = d 2 + 2d and hence the above values of d, p and r), 
we have 

70*0 


(d + l) s 


T = 


4 d' 


# 


s0*0 


: l<x< 


/i j p| g'j < (l + h p p~ d ) h T+oW T 1/2 


where T = ffG- Under the condition of the lemma we have 

70*0 


# 


s0*0 


1<X< 


h }r\s)= h 


and the result follows. 


□ 
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2.5. Proof of Theorem [Q We set 

and h = [e 1//l/ J + 1, 

where c(d) is the constant of Lemma [6j We note that 

26 c{d ) 
v ~ l/ 2d 

so as e —>■ oo we have 

(3) e 1/v <h = e 1/i/+o(1) < e 2/v < p 2S/u < . 

We now query the oracles D e j and £> e ,g for x = 1 ,,h. 

If the oracles return two distinct values then clearly f ^ g. Now 
assume 

f{x) e = g(x) e , x = l 

Therefore, the values f(x)/g(x), x — 1,... ,h belong to the subgroup 
Q e of F* of order e. Hence for the set 

1 < x < h i C F p 


Ul, • • • , Ojp G wd.} ^ Qe- 

We see from (|3]) that Lemma [ 6 ] applies which contradicts (|5]) as we 
have h u > e for the above choice of the parameters. This concludes the 
proof. 


(4) 


A = 


f(x) 

g{x) 


for any integer v > 1 we have 
(5) = {oi... a v 



2.6. Proof of Theorem [2j We fix some e > 0 and set 

h = \ e ^)/[2-2r))^ 

We also note that for the above choice of h and for 

( 6 ) e 1+£ < 
we have 

min{/i 2 ^ 1_T) , h 2 ( 1 _p_r) p 2l? } > e 1+£ . 

Therefore, under the condition © , we derive from Lemma [7] that for 
the set A given by ([3]) we have A % Q e . Proceeding as in the proof of 
Theorem [lj we obtain an algorithm that requires h queries. 

Clearly, for the above choice of h, the condition (| 6 ]) is satisfied if 

(7) e (l+£)p/(l-r) < p # 


Taking 


n 


i?(l — r) 
P 


and 


k = 


1 

2-2 r 
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we see that the condition (JtJ) is equivalent to e < j/dO+'Q under which 
we get an algorithm which requires h — O (e^ 1+£ ) K ) queries. Since e > 0 
is arbitrary, the result now follows. 


3. Quantum and Randomized Interpolation 


3.1. Main results. Here we present a quantum algorithm for the in¬ 
terpolation problem of finding an unknown monic polynomial / G 
F g [X] of degree d given the oracle O e j. We emphasise the difference 
between our settings where the oracle is classical and only the algo¬ 
rithm is quantum and the settings of [ vD02 . lvDHI06j which employ 
the quantum analogue of the oracle Q e j. 

We recall that the oracle D e j does not accept queries from field 
extensions of ¥ q , and therefore, if de > q, we cannot interpolate f e 
from queries to O e j. 

Theorem 8. Given an oracle D e j for some unknown monic polyno¬ 
mial f of degree at most d, for any e > 0 there is a quantum algorithm 
to find with probability 1 — e a polynomial g such that g ~ e f in time 
e d ! 2 (dlogt/log(l/e))° l ' 1) and O (c/logglog(l/e)) calls to D e j. 

Replacing quantum parts of the algorithm above with classical (ran¬ 
domized) methods, we obtain the following. 


Theorem 9. Given an oracle D e j for some unknown monic polyno¬ 
mial f of degree at most d, for any e > 0 there is a randomized algo¬ 
rithm to find with probability 1 — e a polynomial g such that g / m 
time e d (dlogglog(l/e))° (1) and O (d log q\og{l/e)) calls to D e j. 


The proofs of Theorems [ 8 ] and [9] are given below in Sections 3.3 
and |3.4[ respectively. 


3.2. Coincidences among eth powers of polynomials. The fol¬ 
lowing result is immediate from the Weil bound on multiplicative char¬ 
acter sums, see [IK04, Theorem 11.23]. 

Lemma 10. Let g\ , r/ 2 € F f/ [X] be two monic polynomials of degree at 
most d with gi 7 Q g 2 . Then 

G F q : g^xf = g 2 (x) e } = - + 0(dq 1/2 ). 

e 

We now immediately conclude. 

Corollary 11. Let gi,g 2 G F g [X] be two monic polynomials of degree 
o(q 1 i 2 ) with g 1 7 Q g 2 . Then for any e < (q — l)/2 and a sufficiently 
large q 

#{x G W q : gi (x) e ± g 2 (x) e } > ^q. 
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3.3. Proof of Theorem [8} Let S stand for the monic polynomials of 
degree at most d. By Corollary [TlJ a random choice of elements x G ¥ q 
gives with probability at least 0.99 a set T of size 0(log |«S|) = 0(d log q) 
such that for every pair f,g E S we have /(a) e = g(a) e for every a G T 
if and only if / 

rsJ c Q • 

We continue with picking d different elements ai,... ,a,d and use the 
oracle O e j to obtain the values bj = j — 1 ,..., d, as well as to 

get the values b(a ) = /(a) e for every a G T. 

Using Shor’s order hireling and discrete logarithm algorithms |Sho97] 
we can also compute a generator ( e for the multiplicative subgroup 
{u G F, :u e = l} and for every j an element Zj G ¥ q such that z? = bj. 

The cost of the steps performed so far is polynomial in log q and d. 
Let E = {0,..., e — 1}. For a tuple ol = (an, ..., ad) from E d , let 
f a be the monic polynomial of degree at most d such that /«(%) = 
ZjCe 3 , j = 1, ■ ■ ■, d. For any specific tuple a, the polynomial f a can be 
computed by simple interpolation in time polynomial in d log q. 

We use Grover’s search [ Gro96] over E d to find a tuple a with prob- 
ablity at least 0.99 such that f^(a ) = b(a) for every a G T. The cost of 
this part is bounded by 0(e d//2 ) times a polynomial in logg and d. Re¬ 
peating the whole procedure 0(log(l/e:)) times we achieve the desired 
probability level, which concludes the proof. 


3.4. Proof of Theorem [9| Observe that a generator for the group 
{u G ¥ q : u e = 1} as well as elements z 3 with = bj can be found 
by simple classical algorithms of complexity bounded by e 1/,2 (log g)°(b, 
that is, even within the complexity bound of Theorem [8j Indeed, as¬ 
sume that for every prime r diving e we have an element g r G ¥ q which 
is not an rth power of an ¥ q element. Such elements can be found 
in time (logg)°(b using random choices. The product of appropriate 
powers of the elements g r is a generator for the group of the eth roots 
of unity. 

For computing an eth roots of bj it is sufficient to be able to take rth 
root of an arbitrary held element y for every prime divisor r of e. This 
task can be accomplished in time A/r(logg)° < - 1 ) as in the algorithm of 
Aclleman, Manders and Miller [ AMM77] instead of the brute force one 
that uses Shanks’ baby step-giant step method for computing discrete 
logarithms in groups of order r, see |CP011 Section 5.3]. 

Therefore, if we replace Grover’s search |Gro96j over E d with a clas¬ 
sical search we obtain a classical randomised algorithm of complexity 
e d (dlogglog(l/£)) 0 ^). 
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3.5. Further Remarks. Under Generalised Ricmann Hypothesis we 
can derandomize the proof of Theorem [9j If g = p is a prime then a 
generator for the group of eth roots of unity can be found in determinis¬ 
tic polynomial time. If, furthermore, e < p 6 or e < p v ~ 5 for some fixed 
S > 0, then we could use the test of Theorem [l] or Theorem [2] to ob¬ 
tain a deterministic algorithm of complexity e d+c ° UP 1/( “ d ^(dlogp) 0 ^ 
or e d+K+0 ^ 1 ' ) ((ilogp) 0 ^ 1 \ respectively. 

4. Comments and open problems 

One can obtain analogues of Theorems [T| and [2] in the settings of 
high degree extensions of finite fields. More precisely, if q = p n for 
a fixed p and growing n, we write ¥ q = F p [X]/ (i/}(X)) for a fixed 
irreducible polynomial if) G F p [X] of degree n. Then one can attempt 
to transfer the technique used in the proofs of Theorems [T| and [2] to 
this case where a role of a short interval of length h is now played by 
the set of polynomials of degree at most h. This approach has been 
used in CS 13 j Shpl4| for several related problems. We also note that a 
version of effective Hilbert’s Nullstellensatz for function fields, which is 
needed for this approach, has recently been given by D’Andrea, Krick 
and Sombra |DKSl3j . 

We remark that we do not know how to take any advantage of ac¬ 
tually knowing g , and get stronger version of Theorems [l] and [2] in this 
case, like, for example, in [ BGKS12I Section 3.2], 
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